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Abstract 



We show how to encode 2 n (classical) bits 01, 0.2^ by a single quantum state |^) of 
size 0(n) qubits, such that: for any constant k and any i\, ...,ik £ {1, ...,2 n }, the values 
of the bits a^, aj fe can be retrieved from \$?) by a one-round Arthur-Merlin interactive 
protocol of size polynomial in n. This shows how to go around Holevo-Nayak's Theorem, 
using Arthur-Merlin proofs. 

We use the new representation to prove the following results: 

1. Interactive proofs with quantum advice: 

We show that the class QlP/qpoly contains all languages. That is, for any language 
L (even non-recursive), the membership x G L (for x of length n) can be proved 
by a polynomial-size quantum interactive proof, where the verifier is a polynomial- 
size quantum circuit with working space initiated with some quantum state |^L,n) 
(depending only on L and n). Moreover, the interactive proof that we give is of 
only one round, and the messages communicated are classical. 

2. PCP with only one query: 

We show that the membership x G SAT (for x of length n) can be proved by a 
logarithmic-size quantum state |^), together with a polynomial-size classical proof 
consisting of blocks of length polylog(n) bits each, such that after measuring the 
state \^f) the verifier only needs to read one block of the classical proof. 

While the first result is a straight forward consequence of the new representation, the sec- 
ond requires an additional machinery of quantum low- degree-test that may be interesting 
in its own right. 
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1 Introduction 



1.1 Around Holevo's Theorem 

A quantum state of n qubits contains an infinite amount of information. If the state is only 
given up to some fixed (say, constant) precision it still contains an exponential amount of 
information. On the other hand, a quantum measurement can only give n bits of information 
about the state. One way to formalize the last statement is given by Holevo's theorem [Hoi]. 

A simplified version of Holevo's theorem can be stated as follows: If n (classical) bits 
ai,...,a n are encoded by a single quantum state = \^(a±, a n )), such that the original 
values of the bits a-i, a n can be retrieved from the state then is a state of at least 
n qubits. In other words: Assume that Bob encodes n bits ai,...,a n by a quantum state 

and sends to Alice. Assume that Alice can retrieve the original values of 
by measuring the state Then, is a state of at least n qubits. Moreover, if we only 
require that each is retrieved correctly with probability 1 — e, and allow an error to occur 
with probability e, then |^) is a state of at least (1 — H(e)) • n qubits, where H(e) denotes the 
Shannon's entropy of the distribution (e, 1 — e). 

A strengthening of Holevo's theorem was suggested by Ambainis, Nayak, Ta-Shma, and 
Vazirani [ANTV] and was proved by Nayak [Nay]. A simplified version of Nayak's theorem 
can be stated as follows: Assume that Bob encodes n bits a\, ...,a n by a quantum state 
and sends to Alice. Assume that for every index i e {1, ...,n} (of her choice), Alice can 
retrieve the original value of by measuring the state Then, is a state of at least n 
qubits. Moreover, if we only require that Alice retrieves correctly with probability 1 — e, 
and allow an error to occur with probability e, then is a state of at least (1 — H(e)) • n 
qubits. 

Note that the difference between Holevo's theorem and Nayak's theorem is that in Holevo's 
theorem we require that Alice can retrieve the values of all the original bits, whereas in Nayak's 
theorem we only require that Alice can retrieve the value of one bit of her choice. Note that by 
the uncertainty principle these two tasks are not necessarily equivalent. It was demonstrated 
in [ANTV] that the two tasks are indeed not equivalent. 

In this paper, we suggest the use of Arthur-Merlin protocols to go around Holevo's and 
Nayak's theorems. Roughly speaking: Bob will encode a large number of (classical) bits by a 
very short quantum state and will send that state to Alice. Alice will not be able to retrieve 
even one of the original bits by herself. Nevertheless, the value of each one of the original 
bits can be retrieved by an Arthur-Merlin protocol, with a third party, the infinitely powerful 
prover Merlin. In this protocol, Alice acts as the verifier Arthur. In other words, although 
Alice is not able to retrieve the value of the ith bit by herself, Merlin will tell her that value 
and will be able to convince her that this value is correct. Note that in this setting Bob is 
completely trustable and hence Alice can count that the quantum state given by Bob correctly 
encodes the original bits. Merlin, on the other hand, cannot be trusted and hence Alice needs 
to be convinced that his answer is correct. 
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Interestingly, the communication between Alice and Merlin in our protocol will be clas- 
sical. They will not need to exchange quantum states. We can hence assume w.l.o.g. that 
Merlin is an infinitely powerful classical computer. Alice, on the other hand, will need to 
have the ability to measure the quantum state sent by Bob, but her computational power will 
be polynomially bounded (as required in an Arthur- Merlin protocol). 

More precisely, we will construct a protocol that works as follows: Bob encodes 2™ (classi- 
cal) bits di, by a quantum state |\&) = |\P(ai, a2«)) of size 0(n) qubits, and sends \^/) 
to Alice. Alice measures the state Given an index % G {1, 2 n } (of her choice), and based 
on the result of the measurement, Alice composes a (classical) question q of length poly(n) 
bits and sends (i, q) to Merlin. After seeing (i, q), Merlin responds with a (classical) answer r 
of length poly(n) bits. Based on i, q, r, Alice decides on a value V{i, q, r) G {0, 1, Err}, where 
is interpreted as Oj = and 1 is interpreted as Oj = 1, and Err is interpreted as a declaration 
that Merlin is cheating. We will have the following (standard) completeness and soundness 
properties for this protocol: 

1. For any i, q, there is an answer r, such that V(i, q, r) = (with probability 1). 

2. For any i,q,r, we have that V(i,q, r) G {ai, Err} with probability > 1 — l/n n ^\ 

In other words, for any index i and question q, Merlin will be able to give an answer r that 
causes Alice to conclude the correct value of Oj, and on the other hand, no answer given by 
Merlin can cause Alice to conclude the incorrect value of a, (with non-negligible probability). 

Our results are in fact more general: We will be able to encode and retrieve cl\, ct2 n that 
can get different values, rather than bits (i.e., each a, can be a block of O(logra) bits). 
Moreover, we will be able to retrieve any constant number of values a^, . 

1.2 The Exceptional Power of QlP/qpoly 

Interactive proofs were introduced by Goldwasser, Micali and Rackoff and by Babai and 
Moran [GMR, Bab, BM], and were extended to the quantum case by Watrous [Wat]. The 
simplest version of a quantum interactive proof is a one-round (i.e., two messages) quantum 
interactive proof, usually called a QIP(2) proof. 

In a QIP(2) proof, the infinitely powerful prover Merlin tries to convince the verifier 
Arthur for a membership x G L, (where L is some language and x is an input of length n, and 
both x and L are known to both parties). Both parties have quantum computers and they 
can communicate between them quantum states. Merlin's computational power is unlimited 
(but he must obey the laws of physics). Arthur's computational power, on the other hand, 
is limited to (quantum) polynomial time. The proof has one round of communication, where 
the two parties exchange between them quantum states. 

In this paper, we will not need the full power of QIP(2) proofs. We will use a subclass 
of proofs that we call QIP(2)* proofs. In a QIP(2)* proof, Arthur and Merlin communicate 
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between them classical messages, rather than quantum states. We can hence assume w.l.o.g. 
that Merlin is an infinitely powerful classical computer. Arthur, on the other hand, will need 
to have the ability to work with quantum states (in order to be able to work with the quantum 
advice discussed below). 

A QIP(2)* proof has one round of communication: Based on x (and possibly on a random 
string), Arthur composes a classical question q of length poly(n) bits and sends q to Merlin. 
After seeing (x, q), Merlin responds with a classical answer r of length poly(n) bits. Based on 
x,q,r, Arthur decides on a value V(x, q,r) G {Accept, Reject}, where Accept is interpreted 
as x G L and Reject is interpreted as a declaration that Merlin is cheating. The following 
completeness and soundness properties should be satisfied 1 (for some small constant e): 

1. For any x G L and any q, there is an answer r, such that V(x, q, r) = Accept, with 
probability > 1 — e. 

2. For any x G" L and any q, r, we have that V(x, q, r) = Reject, with probability > 1 — e. 

In other words, if x G L then for any question q Merlin will be able to give an answer r that 
causes Arthur to accept (with high probability), and on the other hand, if x G" L then for 
any question q no answer given by Merlin can cause Arthur to accept (with non-negligible 
probability) . 

In this paper, we are interested in the class QIP(2)* /qpoly, that is, the class of languages 
that have polynomial-size QIP(2)* proofs with a polynomial-size quantum advice. A 
QIP(2)* I 'qpoly proof is the same as a QIP(2)* proof, except that the computational power of 
Arthur is quantum polynomial time with a polynomial-size quantum advice. In other words, 
Arthur is a quantum circuit in BQP / qpoly . We can think of a circuit in BQP / qpoly as 
a polynomial-size quantum circuit with working space initiated with an arbitrary quantum 
state \^L,n) (depending only on L and n). We think of the state \^L,n) as a (polynomial-size) 
quantum advice (given to the verifier). 

The notion of quantum advice was studied in several previous works [NY, Aar], as a 
quantum analog to the notion of classical advice (or classical non-uniformity). These works 
concentrated on the class BQP/ qpoly and proved some limitations of that class. In particular, 
Aaronson proved that the class BQP/ qpoly is contained in the classical class PP/poly [Aar]. 
It is hence somewhat surprising that QIP{2)* / 'qpoly proofs are so powerful. 

We show that the class QIP{2)* / qpoly contains all languages. That is, for any language L, 
there is a polynomial-size QIP{2)* / qpoly interactive proof for the membership x G L. Since 
any QIP(2)* / 'qpoly proof is also a QIP{2) / qpoly proof, this obviously means that that the 
class Q I P (2) / qpoly , and hence also QIP/ qpoly, contain all languages. 

1 In the protocols constructed in this paper, we will actually have perfect completeness, i.e., e = in the 
first item bellow. 
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1.3 A Quantum Version of the PCP Theorem 



A probabilistic checkable proof (PCP) is a proof that can be (probabilistically) verified by 
reading only a small portion of it. The PCP theorem [BFL, FGLSS, AS1, ALMSS] states 
that for any x G SAT (where x is an input of length n), there is a PCP p for the membership 
x G SAT, such that the proof p is of length poly(n) bits and it can be (probabilistically) 
verified by reading only a constant number of its bits. Moreover, there is a PCP p for the 
membership x G SAT, such that the proof p is consisted of poly(n) blocks of length 0(1) bits 
each and it can be (probabilistically) verified by reading only two of its blocks. A similar PCP 
that can be verified by reading only one of its blocks is obviously impossible, under standard 
hardness assumptions (even if we allow the length of each block to be almost linear). 

In this paper, we show that the membership x G SAT (for x of length n) can be proved 
by a logarithmic-size quantum state \^>), together with a polynomial-size classical proof p 
consisting of blocks of length polylog{n) bits each, such that after measuring the state |^) the 
verifier only needs to read one block of the proof p. 

More precisely, the verifier can be modelled by a polynomial-size quantum circuit. For any 
x G SAT, there exists a logarithmic-size quantum state and an array p of poly(n) blocks 
of length polylogiji) bits each, that encode a proof for the membership x G SAT and can 
be verified as follows: The verifier applies on a carefully designed (probabilistic) unitary 
transformation U (that can be computed in quantum logarithmic time). The verifier measures 
some of the bits of U\^). Denote the collapsed state (after the measurement) by |^'). Based 
on x and on the result of the measurement, the verifier composes a (classical) query q (of 
length O(logn) bits) and reads the gth block of p. Denote the value of that block by r. 
Based on x, q, r, the verifier applies a unitary transformation U' (that can be computed in 
quantum logarithmic time) on and measures all bits of U'\^'). Based on the result of the 
measurement, the verifier decides whether to Accept or Reject, where Accept is interpreted as 
x G SAT and Reject is interpreted as a declaration that the proof (\^>),p) is not correct. We 
will have the following completeness and soundness properties (for any fixed constant e > 0): 

1. For any x G SAT, there exist |\&) and p that cause the verifier to accept with probabil- 
ity 1. * 

2. For any x G" SAT, and any |^) and p, the verifier rejects with probability > 1 — e. 
1.4 Methods 

We combine methods previously used in the field of probabilistic checkable proofs and methods 
previously used in the field of quantum computations, together with some new ideas. 

The quantum state \^{a\, a2«)), from Subsection 1.1, is a quantum representation of the 
so called, low degree extension, of Low degree extensions were extensively used in 

the past in the study of randomness and derandomization and probabilistic checkable proofs. 
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For the retrieval protocol of Subsection 1.1, we use the random self reducibility property and 
the locally decodability property of the low degree extension. 

For the results discussed in Subsection 1.2, we will use as a quantum advice the quantum 
state |^(ao, ...,a2»-i)), where = 1 iff i G L. The results of Subsection 1.2 will then follow 
immediately from the ones of Subsection 1.1. 

For the results discussed in Subsection 1.3, we will use the quantum state |^(ai, ...,a m )), 
where (a 1: ...,a m ) is a (classical) PCP for the membership x G SAT. Note, however, that in 
the setting of Subsection 1.3 the verifier cannot assume anything about the quantum state 
given to him, as it is given by the (un-trusted) prover. The verifier cannot even trust that the 
quantum state given to him is a correct representation of the low degree extension of some 
sequence of bits. A key step in our analysis will be a quantum low degree test that will ensure 
that the state is close to a quantum representation of some multivariate polynomial of low 
degree. Since this seems to be impossible for the verifier to do by himself, the test is done 
with the help of a classical PCP (or equivalently, with the help of a classical prover). 

Note that in the setting of Subsection 1.3, the verifier cannot query the classical proof 
more than once. Moreover, the verifier can measure the quantum state only once (as the 
state collapses after the measurement). Hence, the verifier cannot apply both the quantum 
low degree test and the retrieval protocol. We will hence need to integrate these two tasks. 
We will do that using ideas from [DFKRS]. A special attention is given to the probability of 
error, as we would like to keep it as small as possible (and in particular, sub- const ant). 

Most of the technical work in the paper is done in the proofs of the results discussed in 
Subsection 1.3 (including the proof for the correctness of the quantum low degree test). 

1.5 Discussion 

The PCP style results of Subsection 1.3 scale up to languages in NEXP. More precisely, 
for any language L G NEXP, the membership x G L (for x of length n) can be proved 
by a polynomial-size quantum state |\&), together with an exponential-size classical proof p 
consisting of blocks of length poly(n) bits each, such that after measuring the state the 
verifier only needs to read one block of the proof p. 

There are several alternative ways to present the last result. One of them is the following: 
Consider a two-rounds interactive proofs model, where the prover has quantum power in the 
first round but only classical power in the second round (note that in the second round the 
prover still has an infinitely powerful classical computer, but he cannot access any quantum 
state). Then, for any language L G NEXP, the membership x G L (for x of length n) can 
be proved by a polynomial-size interactive proof in this model. 

Note that IP = PS PACE [LFKN, Sha], and QIP C EXP [KW]. Thus, if the prover 
has classical power in both rounds or quantum power in both rounds we are not likely to be 
able to prove memberships x G L even for languages L G NTIME(n logn ). In contrast, if the 
prover has quantum power in the first round and classical power in the second we are able to 
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prove memberships x6l for any L G NEXP. 

One can ask why it is not possible to use the same protocol when the prover is quantum 
in both rounds. The reason is that if we do so, the answers given by the prover in the second 
round may depend on the results of a measurement of a quantum state that is entangled to 
the state supplied to the verifier in the first round. This forms a sophisticated version of the 
EPR paradox, in the spirit of [CHTW]. 

1.6 Preliminaries 

We assume that the reader is familiar with the basic concepts and notations of quantum 
computation. For excellent surveys on the subject see [Aha, NC]. 

Let F be a field of size 2 a for some integer a (that will be a function of n and will be 
determined later on). Our basic quantum element will be a quantum register of a qubits, 
rather than a single qubit. Each such basic element represents a member of the Hilbert space 
C' F L We denote by {|e)} eg _F the standard basis for that space. 

The base for the logarithm in this paper is always 2. By [to] we denote the set {1, ...,to}. 
We denote probabilities by Prob and expectations by Exp. We say that a multivariate poly- 
nomial is of total degree r if its total degree is at most r. 

2 The Exponential Information of a Quantum State 

In this section, we present the results discussed in Subsection 1.1. We will encode 2 n (classical) 
bits di, by a quantum state |\&) = |^(ai, a,2 n )) of size 0(n) qubits. We will show how 
to retrieve the value of any of the original bits by a (polynomial-size) Arthur-Merlin protocol. 
Our protocol is in fact more general: We will be able to encode and retrieve that 
can get different values, rather than bits (i.e., each a; can be a block of O(logn) bits). 

2.1 Quantum Low Degree Extension 

W.l.o.g., assume that n > 4 is an even power of 2 (otherwise, we just increase n to at 
most An, by padding with zeros). Denote by F a field of size 2 a = rf, where c is a large 
enough constant integer that will be determined later on (for the content of this section, 
c = 2 is enough). Let H C F be any (efficiently enumerable) subset of size ^fn (e.g., the 
lexicographically first elements in some representation of the field F). Denote d = 2n/logn, 
and assume for simplicity of the presentation that d is integer. Note that \H d \ = 2 n . Denote 
by 7i : H d — > [2™] any (efficiently computable) one-to-one function (e.g., the lexicographic 
order of H d ). 

Let ai, a 2 n e F. We can view (oi, a 2 n) as a function from H d to F. More precisely, 
define A : H d — > F by A(z) = a^ z ). A basic fact is that there exists a unique extension of 



7 



A into a function A : F d — > F, such that A is a multivariate polynomial (in d variables) of 
degree at most | H\ — 1 in each variable. The function A is called, the low degree extension of 
a±, a,2« ■ Note that the total degree of A is lower than 2n L5 / logn < n 15 . 

We define the quantum low degree extension of ai, a 2 n, by 

|*(ai, a 2 n)) = \F\- d / 2 ■ ]T l*i)l*2> • • • ^)>. 

Zl,..,2 d gF 

Note that |^(ai, 02™)) is a quantum state of (d+ l)clogn = 2cn + clogn = O(n) qubits. 

2.2 The Retrieval Protocol 

Assume now that Alice got the state = Ol, (22™ 

)) and she wants to retrieve the value 
of dj for some i G [2 n ], or more generally, the value of for some w G -F d . This can be 

done by the following interactive protocol with the infinitely powerful prover Merlin. 

Alice Measures all qubits of and gets as a result a random z G F d and the value A{z). 
If z 7^ w, Alice computes the line (i.e., afline subspace of dimension 1 in F d ) that contains 
both w and z. Formally, this line is the set 

i = { w + ( z - w ) . t} teF c F d 

(where all operations are in the vector space F d ). Alice sends i to Merlin 2 . Merlin is required 
to respond with the value of A on all the points in t. Denote by g(t) the value given by Merlin 
for the point w + (z — w) • t. 

Roughly speaking, Alice will reject (i.e., conclude the value Err) if g : F — > F is not a 
low degree polynomial in the variable t, or if g(l) disagrees with the value A(z) (which is the 
only value of A that Alice knows). 

Formally, denote by A\i : F — > F the restriction of A to the line i (parameterized by t). 
That is, A\ t {t) = A(w + (z — w) • t). Recall that the total degree of A is < n 1 - 5 . Hence, A\ e 
is a polynomial (in the one variable t) of degree < n 15 . If g is not a polynomial of degree 
< n L5 then Alice rejects automatically. Otherwise, Alice checks whether or not g(l) = A(z). 
If g(l) 7^ A(z) Alice rejects (note that g(l) is the value given by Merlin for the point z). 
Otherwise, Alice concludes the value g(0) (i.e., the value given by Merlin for the point w). 

2.3 Analysis of the Protocol 

The analysis of the retrieval protocol of Subsection 2.2 is extremely simple. 

2 This can be done by sending w and one additional point (say, the lexicographically first point) in i. Note 
that Merlin doesn't know z. (We don't care if Merlin does know w, but note that we could also send I by just 
sending two different points (say, the two lexicographically first points) in it). 
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Denote by r a strategy of Merlin in the protocol. Formally, r is just the set of all answers 
given by Merlin for all possible pairs (w,£). W.l.o.g., we can assume that the strategy r 
is deterministic. Denote by Vm(\^),w,r) the value concluded by Alice when applying the 
protocol on a quantum state |\&) and a point w G F d , when Merlin is applying the strategy r. 
Note that Vri(|^), w, r) is a random variable. Recall that for ai,...,a2« G F, we denote by 
A : F d — > F the low degree extension of ai,...,a2« and by ^(ai, c^™)) the quantum low 
degree extension of 0\ , . . . , O2" j &S defined in Subsection 2.1. 

The completeness and soundness properties of the protocol are given by the following 
lemma. 

Lemma 2.1 For G F and every w G F d , 

1. 3r, s.t. VRi(|^(ai, a2«)), w, r) — A(w) with probability 1 . 

)),w,r) G {A(w),Err} with probability > 1 — l/n c 1-5 . 

Proof: 

Obviously, if Merlin's answer on line £ is the polynomial g — A\g then Alice concludes the 
correct value A(w) with probability 1. So, the first part is obvious. 

For the second part, note that if Merlin's answer on a line I is a polynomial g of degree less 
than n 15 then either g is the same polynomial as A\% or the two polynomials agree on less than 
n 1 ' 5 points. In the first case, Alice concludes the correct value A(w). In the second case, Alice 
will reject for every value z G £ \ {w} on which the two polynomials disagree. (Recall that 
Merlin doesn't know z and only knows the description of the line £). Thus, Alice rejects on a 
fraction of at least 1 — n L5 /|F| of the points in £ \ {w}. Summing over all lines, with probabil- 
ity of at least 1 — n 1 - 5 /\F\ = l — l/n^ 1 - 5 Alice will either conclude the correct value or reject. □ 



2.4 Retrieving More Values 

Suppose now that we want Alice to be able to retrieve the values of a^, a ik , for k > 1. An 
obvious way to do that is by encoding Ol, 0,2™ 

by the tensor product of 0,1, (22™ )) with 
itself k times, that is, by the state <g) • • • <g) |\&), where |^) = |^( Ol, 02" 

)) is the quantum 

low degree extension of ai,...,a2™, (as before). Alice can now retrieve one value from each 
copy of the state |\&). Moreover, this can be done in parallel in one round 3 . 

In this paper, we will not use this method. We will need, however, a method to retrieve 
more than one value from only one copy of |^(ai, ...,a 2 «)). This can be done by a general- 
ization of the retrieval protocol of Subsection 2.2. For simplicity of the presentation, we will 
present here the retrieval of only two values. The same protocol generalizes to an arbitrary k. 
The complexity of the retrieval protocol, however, is exponential in k. 

3 It is not hard to show that in this setting applying the protocol in parallel is practically equivalent to 
applying it sequentially. Issues of parallel repetition, such as the the ones in [Raz] , are not a problem here. 
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Assume that Alice got the state = \^f(ai, a 2 n)) and she wants to retrieve the values 
of a,i,ai' for some (different) G [2 n ], or more generally, the values of A(w),A(w') for some 
(different) w,w' G F d . This can be done by the following interactive protocol. 

Alice Measures all qubits of |\&), and gets as a result a random z G F d and the value A{z). 
Alice computes the plane (i.e., affine subspace of dimension 2 in F d ) that contains all three 
points w,w',z. Formally, this plane 4 is the set 

p = {w + (z - w) ■ ti + (w - w) ■ t 2 }t u t 2 eF C F d . 

Alice sends p to Merlin, who is required to respond with the value of A on all the points in p. 
Denote by g(ti, t 2 ) the value given by Merlin for the point w + (z — w) • t± + (w' — w) ■ t 2 . 

If g is not a polynomial of total degree < n 15 then Alice rejects automatically. If g(l, 0) 7^ 
A(z) Alice rejects as well. Otherwise, Alice concludes the values (<?(0, 0), g(0, 1)) (i.e., the 
values given by Merlin for the points w,w'). 

Denote by r a strategy of Merlin in the protocol. Denote by Vr 2 (\^), (w, w'),r) the values 
concluded by Alice when applying the protocol on a quantum state and points w, w' G F d , 
when Merlin is applying the strategy r. The completeness and soundness properties of the 
protocol are given by the following lemma. 

Lemma 2.2 For every a 1? ...,a 2 n G F and every w,w' G F d , 

1. 3r, s.t. V R2 {\^{ )),(w,w'),r) = (A(w),A(w')) with probability 1. 

2. Vr ; V R2 (\^(a 1: ... : a 2 n)) : (w : w') : r) G {(A(w), A(w')), Err} with probability > l-l/n - 1 - 5 . 

Proof: 

Same as the proof of Lemma 2.1 □ 



3 Interactive Proofs with Quantum Advice 

In this section, we present the results discussed in Subsection 1.2. Quantum interactive proof 
systems were first introduced by Watrous (see [Wat] for the formal definition). In these 
proof systems, the verifier can be modelled by a polynomial-size quantum circuit. Quantum 
interactive proof systems with polynomial-size quantum advice are defined in the same way, 
except that the verifier is modelled by a polynomial-size quantum circuit with a polynomial- 
size quantum advice. That is, the verifier is a polynomial-size quantum circuit, with working 
space initiated with an arbitrary quantum state (The state \^/) is considered to be part 
of the description of the circuit and it cannot depend on the inputs to the circuit). 

4 Note that if z, w, w' happen to be on the same line then p is a line rather than a plan. Nevertheless, we 
can proceed in the exact same way. 
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The class QlP/qpoly is defined to be the class of all languages that have polynomial- 
size quantum interactive proofs with a polynomial-size quantum advice. We show that the 
class QlP/qpoly contains all languages. For any language L, the membership x G L can 
be proved by a polynomial-size quantum interactive proof, with a polynomial-size quantum 
advice. Moreover, the interactive proofs that we construct for the membership x G L are of 
only one round, and all messages communicated are classical 5 . 

Theorem 3.1 QlP/qpoly contains all languages. 

Proof: 

Let L be any language. For a string % of length n bits, define a; = 1 iff % G L. We will use 
as a quantum advice for the verifier the quantum low degree extension |\l/(ao, ...,a2«-i)) (see 
Subsection 2.1). The proof now follows by the retrieval protocol of Subsection 2.2. Given x of 
length n bits, the verifier uses the retrieval protocol to retrieve the value of a x (by an interac- 
tive protocol with the prover). The verifier accepts iff the value concluded by the protocol is 1 
(and rejects if the value concluded is or Err). The completeness and soundness properties 
follow immediately by Lemma 2.1. More precisely, if x G L there is a strategy for the prover 
that causes the verifier to accept (with probability 1), and on the other hand, if x G" L then 
no strategy for the prover can cause the verifier to accept with non-negligible probability. □ 



4 Quantum Low Degree Testing 

In the settings of Subsection 1.1 and Subsection 1.2, a verifier could assume that the quantum 
state given to him is a correct quantum low degree extension of some a±, a 2 n (as defined in 
Subsection 2.1). In the setting of quantum proofs, and quantum versions of the PCP theorem, 
a verifier cannot assume anything about a quantum state given to him. A key step towards 
proving the results discussed in Subsection 1.3 is a quantum low degree test, developed in this 
section. Roughly speaking, a quantum low degree test intends to check whether a quantum 
state is close to a representation of a polynomial of small total degree. 

4.1 Classical Low Degree Tests 

Roughly speaking, a (classical) low degree test intends to check whether a multivariate function 
is close to a polynomial of small total degree. Low degree tests and their applications have 
been studied in numerous of works and have been central in the study of interactive proofs 
and probabilistic checkable proofs (see for example [BFL, FGLSS, AS1, ALMSS]). In this 

5 Note that formally in the standard definition of quantum interactive proofs the parties can only commu- 
nicate between them quantum messages. Nevertheless, since a quantum states can encode classical messages, 
the model is equivalent to a model where the parties can communicate both quantum and classical messages. 
In the interactive proofs constructed here, the parties communicate only classical messages. 
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paper, we will need to use the "low-error" analysis of [RS2, AS2] for (versions of) the test 
presented in [RSI]. 

Let F be a field and let d be some integer. Let L be the set of all lines in F d (i.e., the set 
of all affine subspaces of dimension 1). For every £ e L, let gt : t — > F be a polynomial 6 of 
degree r. Denote, G = {gejeeL- 

For f,f':F d —>F and for G = {ge}eeL as above, denote 

Agr[fJ']=Proh z€F 4f(z) = f'(z)], 

Agr[/,&] = Prob zee [f(z) = g e (z)}, 
Agr[/,G] = Exp <eL Agr [/,#], 
where all probabilities and expectations are with respect to the uniform distribution. 

The Rubinfeld-Sudan test [RSI] suggests that if Agr[/, G] is large then / is close to a 
polynomial of total degree r. The following lemma, that menages to work with quite small 
values of Agr[/, G], was proved in [AS2]. A similar lemma for planes, rather than lines, was 
proved in [RS2] (see also [DFKRS]). Here, we can use any of these tests. We note that the 
lemmas proved in [RS2, AS2] are in fact stronger in several ways. We present them here in a 
simpler form that will suffice for us. 

Lemma 4.1 (Arora- Sudan) Let f : F d — > F be any function, and let G = {gt}eeL be such 
that every g e : £ — > F is a polynomial of degree r. Assume that 

Agr[/,G]>^ 

where c is a (large enough) universal constant and e > is a (small enough) universal constant. 
Then, there exists h : F d — > F of total degree r, such that, 

Agr[/ i ,/],Agr[/ i ,G]>(Agr[/,G]) 2 /32. 

Note that the lemma shows that if Agr[/, G] is large then both / and G are close to a 
polynomial h of total degree r. Interestingly, it will be easier for us to use the claim about G. 

In this paper, we will need a slightly more general version of Lemma 4.1, where we allow 
the polynomials gt : t — > F to take multiple values. More generally, we allow each gt to be a 
random variable, distributed over polynomials of degree r. We update the above notations as 
follows. 

For / : F d — > F and for G = {ge}eeL as above, denote 

Agr[/,&] = Exp g Pr oh zee [f(z) = g e (z)}, 

6 We assume here that I is presented as I = {u + (v — u) ■ i}teF for some u, v € £, and hence we can think 
of gt as a polynomial in the variable t. Note that the degree of ge does not depend on the choice of u, v. 
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Agr[/,G] =Exp €eL Agr [/,&]. 



It is a folklore meta-theorem that all known low degree tests work as well when assignments 
can take multiple values. As before, if Agr[/, G] is large then both / and G are close to a 
polynomial h of total degree r. 

Lemma 4.2 Let f : F d — > F be any function, and let G = {ge}t<=L be such that every 
ge : £ — > F is a random variable, distributed over polynomials of degree r. Assume that 

Agr[/, G]>j^ t 

where c is a (large enough) universal constant and e > is a (small enough) universal constant. 
Then, there exists h : F d — > F of total degree r, such that, 

Agr[/i,/],Agr[/i,G] > (Agr[/, G]) 2 /32. 

The lemma follows by a reduction to Lemma 4.1, using well known methods (see for 
example [AS2, RS2, DFKRS]). 

4.2 The Quantum Test 

Let F be a field of size 2 a for some integer a, and let d be some integer. Recall that our basic 
quantum element is a quantum register of a qubits, rather than a single qubit. Each such 
basic element represents a member of the Hilbert space Cl F L Denote by Hd+i and 7i 2 the 
following Hilbert spaces 

n d+1 = c^ d+1 , 
n 2 = c\ F \\ 

Let L be the set of all lines in F d (as before). Our quantum low degree test intends to check 
whether a quantum state |<3>) G Hd+i is close to a state of the form 

\F\- d / 2 - £ \z 1 )\z 2 )...\z d )\f(z 1 ,...,z d )), 

zi,..,z d eF 

where / : F d — > F is some polynomial of total degree r. In addition to the state |$), the test 
has access to a set of (classical) polynomials G = {ge}eeL, where as before, for every £ e L 
the polynomial ^ : £ — > F is of degree r (see footnote in Subsection 4.1). Each g e is supposed 
to be (in a correct proof) the restriction of / to the line I. In our test, the verifier reads only 
one of the polynomials gg. 
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4.2.1 Step I 

The verifier chooses a random regular (i.e., one to one) linear function E : F d — > F d . The 
function E defines a permutation Ue over the standard basis for Hd+i, as follows: For every 
z— (z\, Zd) G F d and every y G F, 

ki)k 2 ) • • • ^ |£7(*)i>|£(*)2> • • • |£(*) d )|y>. 

Since Ue is a permutation over a basis for Hd+i, it extends to a unitary transformation 

Ue '■ Ti-d+i —> Ti-d+i- 

The verifier computes the quantum state Ue\$) and measures the first d—1 registers of that 
state (i.e., \E(z)\) ■ ■ ■ \E(z)d-i))- Denote by b\, ...,bd-i G F the results of the measurement. 
The state Ue\$) collapses into a state |$') G Ti.2 (in the last two registers). 

Note that the set of solutions for the set of linear equations 

E(z) 1 = &i,...,.E(z) d _i = 

is a line £ E L. The line £ can be presented as £ = {u + (v - 
the unique solution for the set of linear equations E{u) = (&i, . . 
unique solution for the set of linear equations E(v) = (&i, . . . , &<j 

If the original state |<&) is indeed of the form 

\F\- d ' 2 - £ \zi)\z2)---\zd)\f(z 1 ,...,z d )), 
z 1} ..,z d eF 

then the collapsed state |$') G H 2 will be 

i#> = i*r 1/a -Ei*>i/<(*)>, 

where fi : F — > F is the restriction of / to the line £ (parameterized by £), i.e., = 
/( u + ( v -«).*). 

4.2.2 Step II 

The verifier reads the polynomial ge. We can think of this polynomial as a polynomial ge : 
F — > F, where the line £ is parameterized by the same t as above (i.e., the line £ is presented 
as £ = {u + (v — u) ■ t} teF ). 

Denote by |ei) 6H2 the quantum state 

|ei> = |F|- 1/2 -El*>l»(*)>- 



- u) • OteF) where w G F is 
. , bd-i, 0), and t> G F d is the 
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The verifier wants to compare the states |<&') and \ei). This is done as follows. The verifier 
extends |ei) into any orthonormal basis {|ei), . . . , jei^p)} for the space 7i 2 , and measures the 
state |$') according to this basis. The verifier accepts if the result of the measurement is 1 
and rejects in any other case. 

Note that if indeed 

l*') = |iT 1/2 -£l*)l/^)>, 

teF 

and fi = ge, then |$') = \ei) and the verifier accepts with probability 1. In general, the verifier 
accepts with probability 

\(eim\ 2 - 

4.3 Complexity of the Verifier 

The complexity of the verifier in the procedure of Subsection 4.2 is polynomial in \F\ and d. 
To see this, we need to check that both steps can be done in that complexity. 

In the first step, the verifier needs to compute the quantum transformation 

W)\z 2 ) ■ ■ ■ \z d ) .— \E{z) x )\E{z) 2 ) ■ ■ ■ \E{z) d ). 

It is enough to show that the classical transformation 

(zi, z 2 , . . . , z d ) i — ► (E(z) 1 , E(z) 2 , . . . , E(z) d ) 

has a reversible classical circuit of size poly(\F\, d). This follows immediately by the fact that 
any such transformation can be expressed as a product of poly(d) reversible operations on only 
two variables each. One way to do that is by the inverse of the Gauss elimination procedure, 
that shows how to diagonalize any d x d matrix E by a sequence of poly(d) operations that 
work on only two rows each. Note that every operation that works on only two variables 
can be trivially translated into a quantum circuit of size poly(\F\), as the dimension of the 
relevant Hilbert space, TC 2 , is \F\ 2 . 

In the second step, the verifier needs to measure the state |<&') according to the basis 
{|ei), . . . , leijrp)}. Note however that since the space 7i 2 is of dimension |F| 2 , this can trivially 
be done by a quantum circuit of size poly(\F\). 

4.4 Analysis of the Test 

For a quantum state |<E>) G 7id+i and for a set of polynomials G = {ge}eeL (where for every 
£ G L the polynomial gi : £ — > F is of degree r), denote by Vqldt{\^) , G) the probability that 
the quantum low degree test procedure of Subsection 4.2 accepts. 

The completeness of the test is given by the following lemma. The lemma shows that if 
|$) is indeed a correct representation of a polynomial / : F d — > F of total degree r, and each 
ge is the restriction of / to the line £, then the test accepts with probability I. 
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Lemma 4.3 Assume that 

|<t>) = ]F|- d / 2 - £ 1^)1^). •• 1^)1/^,...,^)), 
zi,..,2 d eF 

/or some polynomial f : F d — > F of total degree r . Assume that G = {ge}eeL, where every 
ge : £ — > F £/ie restriction of f to the line £. Then, 

v QLDT m,G) = i. 

Proof: 

The proof is straightforward. As mentioned above, after Step I we get the collapsed state 
|$') = \e\). Hence, the result of the measurement in Step II will always be 1. □ 

The soundness of the test is harder to prove and is given by the following lemma. The 
lemma shows that if Vqldt{\&), G) is large then G is close to a polynomial h of total degree r. 
Recall that the original motivation of the test was to prove that |$) is close to a representation 
of a polynomial h of low total degree. Nevertheless, it will be enough for us to have this 
property for G rather than |<3>). For simplicity of the presentation, we state and prove the 
lemma only for G. 

Lemma 4.4 Let G = {ge}eeL be such that every g t > : £ — > F is a polynomial of degree r . 
Assume that for some quantum state |$) G TLa+i, 

v QLDT m,G)>j F y e 

where c is a (large enough) universal constant and e > is a (small enough) universal constant. 
Then, there exists h : F d — > F of total degree r , such that, 

Agr^G] > [VQ LDr (|$),G)] 4 /50. 
The proof of the Lemma is given in Subsection 4.5. 

As in the case of Lemma 4.1, we will need a slightly more general version of Lemma 4.4, 
where we allow the polynomials gi : i — > F to take multiple values. More generally, we allow 
each gi to be a random variable, distributed over polynomials of degree r. When reading g#, 
the verifier gets an evaluation of that is, each polynomial of degree r is obtained with the 
probability that g^ gets that value. 

We denote by Vqldt(\&) , G) the probability that the quantum low degree test procedure 
accepts on a quantum state |$) and on a set G = {ge}eeL as above. 

Lemma 4.5 Let G = {ge}eeL be such that every ge : £ —> F is a random variable, distributed 
over polynomials of degree r. Assume that for some quantum state |<&) G Hd+i, 
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where c is a (large enough) universal constant and e > is a (small enough) universal constant. 
Then, there exists h : F d — * F of total degree r, such that, 

Agr[/i,G] > [Vq LDT (|$),G)] 4 /50. 

The proof of Lemma 4.5 is the same as the one of Lemma 4.4, using Lemma 4.2 rather 
than Lemma 4.1. 

4.5 Proof of Lemma 4.4 
4.5.1 Notations 

First note that w.l.o.g. we can assume that |<&) is a pure state. For z = (z\, za) £ F d and 
y & F, denote by ZjJ/ the coefficient of |zi)|z2) • • • i n 1^)- That is, 

l*> = E 4>.M\v)- 

zeF d ,y£F 

For every z <E F d , denote 



For every line lei, denote 



Denote 



and note that iV is the number of directions of lines £ in F d . For every z G F d , denote by 
L(z) C L the set of lines £ that contain z. Note that every L(z) is a set of iV lines. 

We denote the total acceptance probability Vq LDT {\$) , G) by 7, i.e., 

i = v QLDT m,G). 

4.5.2 The Acceptance Probability 

Assume w.l.o.g. that every ZjJ/ (and hence also every 2 and every fa) is none-zero. Otherwise, 
we just change the state |<&) to an extremely close state that satisfies that property. (This is 
done for the simplicity of the presentation, in order to avoid divisions by 0). 

In Step I of the test, the linear function E determines the direction of the line £ that we 
obtain in that step. Since E is chosen with the uniform distribution, each direction is chosen 



0* = jE \^,y 
\jyeF 

V zee 
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with probability 1/N. After the direction is chosen, each line £ in that direction is obtained 
with probability <pj. Altogether, every line £ is obtained with probability <fi\/N . 

If a line £ was obtained, the state |<E>) collapses to the state 

l^> = ^- 1 -EE^W,yl*>ll/>. 

where z(t) — u + (v — u) • t, and u, v are the ones defined in Subsection 4.2 (i.e., u, v are such 
that the line £ is presented as £ = {u + (v — u) ■ t}teF, as described in Subsection 4.2). 

Since \ei) = (F^ 1 / 2 • J2teF \t)\9e(t)), the acceptance probability |(ei|$^)| 2 is 

2 



\(eM)\ 2 = 



teF 



z£( 



where (for simplicity) we think of ge as a polynomial ge : F — > F when we write <%(i), and as 
a polynomial ge : £ — > F when we write ge(z). 

The total acceptance probability 7 can now be expressed as 



7 = E 



'0f 

iV 



- 1 -i^r 1/2 -E^) 



IFI-AO^-E 

eel 



E 



We can see from this expression that w.l.o.g. we can assume that all the coefficients 4> z>y of 
the state |<&) are real and positive. (Otherwise, we change each 4> z , y to \4> z ,y\ an d we can om Y 
increase the total acceptance probability). Hence, 

7 = (|F| • AT 1 • E (e<W) ) • ( E <^(*') 
teL \ze<? / \z'e£ 



= (|F| • TV)- 1 • £ £ 2>9£(2) ■ <t> z , Mzl) 
£eL z,z'e£ 

Since every ^z'^z 1 ) is at most 2 /, we can bound 

7<(l^l-iv)- 1 -E E <Wr^ 

We will write the last expression as a sum of two expressions, according to whether or not 
z — z' . The first expression is the sum of all terms where z — z' . That expression is 



1*1 • ■ E E • & < (1*1 • n)- 1 ■ E E <t>\ 



£GL z€£ 



lei zee 



= (\f\-n)- 1 - E E « 

zeF d feL(z) 



1-1 



E< 



IFI- 1 
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Hence, 



7 _i F i-i< ( i F |.7v)-i.^ y: 

= (|fl-iv)- 1 -i; E ^■^■(WW 



and hence by the Cauchy-Schwartz inequality, 



t - IF]- 1 < (\f\ ■ n)- 1 ■ E E (<^-<M 2 - E E (<W)/W 2 

yeeLz^z'ee yeeLz^z'ee 

In this formula, we can substitute 

E E (<^-<M 2 =E E (<^-<M 2 <E E (&-^) 2 =(e#) =1 

eeLz^z'^e z&F d z'^z£F d zeF d z'eF d \zeF d ) 

and 

E E (WW 2 = E E E (WW 2 = (1*1 - 1) • E E (<W)/W 2 

eeLz^z'ei zeF d eeL(z) z'^zei zeF d i&L{z) 

and we get 

(7 - liT 1 ) 2 < (1^1 • iv)" 2 • {\f\ - 1) • E E (WW J 

< i^r^-iv- 1 . e E (WW 2 - (i) 

4.5.3 Using the Classical Test 

We will now define a probabilistic function / : F d — > F. Formally, for every z <E F d wc 
define /(z) as a random variable in F. Alternatively, we can think of / as a distribution over 
functions from F d to F. For every z G F d and y E F, we define 

Prob[/(^)=y] = (0^/0 z ) 2 . 

Note that 

E(<WW 2 = i- 

2/eF 

We extend the definition of Agr[/, G] from Subsection 4.1 to probabilistic functions /. 
Formally, we define 

Agr[/,#] = Ex P/ Prob 2e 4/(z) = 
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Thus, 



Agr[/,G] =Exp ftEL Agr[/,&]. 
Agr[/, G] = Exp ieL Exp fProh zee [f(z) = g e (z)} 



= Exp teL Exp 2e£ Prob / [/(2;) = g e (z)} 
= Exp 2eFd Exp teL(2) Prob / [/(2;) = g e (z)] 

= \F\~ d -N- 1 - E E Prob f [f(z)=g e (z)} 

zeF d £eL(z) 

= \F\~ d -N^- £ E (UW 

> (t-I^I- 1 ) 2 

(by inequality 1). 

Since we can think of / as a distribution over deterministic functions /', the agreement 
Agr[/, G] is a convex combination of Agr[/', G] for deterministic functions /'. Hence, there 
exists a (deterministic) function f':F d ^F with 

Agr[/',G]> (7-lFr 1 ) 2 . 

Hence, by Lemma 4.1, there exists h : F d — > F of total degree r, such that, 

Agr[/i, G] > 7 4 /50 

(under the assumption that the universal constant c is large enough and the universal constant 
e is small enough). □ 



5 Quantum Information and the PCP Theorem 

In this section, we present the results discussed in Subsection 1.3. Roughly speaking, we show 
that the membership x G SAT can be proved by a logarithmic-size quantum state, together 
with a polynomial-size classical proof of blocks of poly-logarithmic length, such that after 
measuring the quantum state the verifier only needs to read one of the blocks of the classical 
proof. 
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5.1 Quantum PCP 



In all that comes below, a verifier is a polynomial-time machine that can process both quantum 
states and classical strings. 

We define an (si, s 2 )- verifier to be as follows: The verifier gets three inputs: (x, \<&),p). 
The first input, x, is a classical string of length n bits. (We think of x as the input whose 
membership in a language L is to be verified). The second input, |<J>), is a quantum state of 
length si qubits. The third input, p, is a classical array of poly{n) blocks of length s 2 bits 
each. (We think of (|<E»),p) as a possible proof for the membership x e L). The verifier is 
allowed to query at most one of the blocks of the third input p. 

We define the class QPCP[si, s 2 , e] as follows: A language L is in QPCPfsi, s 2 , e] if there 
exists an (O(si), 0(s 2 ))-verifier V, such that the following completeness and soundness prop- 
erties are satisfied: 

1. For any x G L, there exist |$) and p, such that 

ProbjV(a;, = accept] = 1. 

2. For any x ^ L, and any |$) and p, 

Prob[l / (x, | = accept] < e. 

The definition extends to promise problems, where we only consider inputs x that satisfy a 
certain promise. 

Theorem 5.1 SAT e QPCP[log(n),polylog(n),o(l)] 

5.2 Proof of Theorem 5.1 
5.2.1 Classical PCP 

For the proof of Theorem 5.1, it is clearly enough to prove L e QPCP[Zog(n) , polylog(n) , o(l)] 
for any other iVP-complete language or promise problem L. We will work with the following 
promise problem that we call GAP(s, q, e): 

An instance of the problem is x = (<pi, where if±, ...,<fk are predicates over a set of 
variables {Y 1: Y m }. Every variable Yi can take 2 s different values (i.e., we can think of every 
Yi as a block of s bits). Every predicate <fi depends on at most q of the variables Yi, Y m . 
The promise is that: either, there is an assignment to Y 1? Y m that satisfies all predicates, 
or, any assignment to Yi, Y m satisfies at most e fraction of the predicates. The goal is to 
accept iff the first possibility is correct (under the assumption that the promise is satisfied). 

Different versions of the PCP theorem prove the iVP-completeness of GAP(s, q, e) for a 
large range of values of the parameters s, q, e. Here, we will be interested in the following 
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parameters: We require s to be at most log log n (where n is the length of x). We require q to 
be constant. We would like e to be as small as possible, preferably sub-constant. (The error 
of our verifier in the proof of Theorem 5.1 will be polynomially related to e. Thus, a small 
constant e is ok if we only want to achieve a small constant error). 

The iVP-completeness of GAP(s, q, e), for some s < loglogn, for some constant q, and 
for some e < (\ogn)~ n( -^ is known [RS2, AS2, DFKRS]. Moreover, if we only tried to achieve 
a small constant probability of error, we could have used many other versions of the PCP 
theorem. For example, we could have used the results in [Raz] and work with q = 2 and an 
arbitrarily small constant e. 

In all that comes below, we fix (s, q, e) such that GAP(s, q, e) is known to be ./VP-complete 
and such that: q is constant, s is at most loglogn, and e is sub-constant. We will show that 
the problem is in QPCP[log(n),polylog(n),o(l)]. The best probability of error that we are 
able to achieve is (\ogn)~ n ^ . 

We will construct a verifier V such that on an instance x = (<fi, <fk) of GAP(s, q, e), 
the following properties are satisfied: 

1. If there exists an assignment to Y 1 ,...,Y m that satisfies all predicates <£>i, <Pk, then 
there exist |<I>) and p, such that 

ProbjV(a;, \&),p) = accept] = 1. 

2. If any assignment to Y 1 ,...,Y m satisfies at most e fraction of the predicates <fi,---, <fk, 
then for any |<3>) and p, 

Pvob[V(x, = accept] < e 

(where e' = o(l)). 

Every assignment to Y\, ...,Y m that satisfies all predicates will translate into (|$),p), such 
that, Prob[l / (x, \&),p) = accept] = 1. We think of as a proof for the satisfiability of 

<f 1 , ip k . We think of the verifier as a procedure that verifies that proof. We will first describe 
how to translate an assignment to Y 1: Y m (that satisfies all predicates) into a (correct) proof 
(|<E>),p), and then describe the verification procedure. 

5.2.2 Preliminaries 

Let x = (ipi, ifk) be an instance of length n of GAP(s, q, e). For simplicity of the notations, 
extend the set of variables {Y\, ...,F m } to {Yi, ...,Y n }, (by adding dummy variables). Denote 
by ti, ifc the sets of variables that the predicates (pi, ...,{p k depend on (respectively). Recall 
that each tj is a set of size at most q. W.l.o.g., we can assume that ti, ...,£& are all different. 
(This is only done for simplifying the notations). W.l.o.g., we can assume that every predicate 
in ipi,...,ifk has at least one satisfying assignment. (Otherwise, it is clear that there is no 
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assignment that satisfies all predicates, and since s is at most log log n the verifier can check 
that easily). 

W.l.o.g., assume that n = 2 n , such that n > 4 is an even power of 2 (otherwise, we just 
increase n to at most n 4 ). The variable n will play the role of n in Subsection 2.1. As in 
Subsection 2.1, denote by F a field of size 2 a = n c , where c is a large enough constant integer 
that will be determined later on. As in Subsection 2.1, denote d = 2n/logn and assume for 
simplicity that d is integer. Assume that d > q + 1. Note that \F d \ is polynomial in n. 

Let H C F be a subset of size \fh, as in Subsection 2.1, and let tt : H d — >■ [2 n ] be a one-to- 
one function, as in Subsection 2.1. We will use here the inverse function 7r _1 : [n] — > F d . This 
function maps the variables in {Yi, Y n } to F d . Intuitively, we think of each variable Yj as 
placed on the point 7r _1 (i) G F d . For every t,-, define Tj = ^^(tj) C F d . W.l.o.g., assume that 
for every Tj, the dimension of the smallest affine subspace of F d that contains Tj is exactly 
q — 1 (otherwise, we add arbitrary points to Tj). 

Let L be the set of all lines in F d , as in Section 4. For any £ E L and any Tj, denote by 
S(£,Tj) the smallest affine subspace of F d that contains both £ and Tj. This subspace will 
usually be of dimension q + 1, and will always be of dimension at most g + 1. 

For an assignment a\, ...,a n to Y 1; Y n , let A : F d — > F be the low degree extension of 
defined in Subsection 2.1. Recall that the total degree of A is less than n L5 . For 
any affine subspace S C F d , denote by A\ s the restriction of A to S. We think of A\ s also as 
a function from F d to F, where d! is the dimension of S, and where formally we assume that 
some (linear) parameterization of the affine space S is implicit. 

5.2.3 The Correct Proof 

An assignment to Yi, Y n , that satisfies all predicates, translates into (\$),p) that 

causes the verifier to accept with probability 1. We refer to that (|$),p) as the correct proof. 

The state |$) of the correct proof will be the quantum low degree extension of ai, ...,a n , 
i.e., ...,a n )), as defined in Subsection 2.1. Note that this is a state of 0(n) = O(logn) 

qubits. The array p will have one block for every pair (r,-, S), such that S C F d is a q + 1 
dimensional affine subspace that contains r^. In the correct proof, this block will contain the 
restriction A\ s (as in [DFKRS]). Note that the number of blocks is bounded by k ■ \F\ 2d which 
is polynomial in n, and the size of each block (i.e., the number of bits it takes to describe each 
A\s) is bounded by a ■ (n L5 ) 9+1 , which is poly-logarithmic in n. 

5.2.4 The Verification Procedure 

Denote by p{jj, S) the content of the block indexed by (-n,-, S) of p. Recall that in the correct 
proof p(Tj,S) = A\ s and recall that A\ s is a polynomial of total degree at most n L5 . Note 
that from A\$ one can induce the restriction of A to Tj, as well as the restriction of A to any 
line £ contained in S. Note that the restriction of A to Tj gives the values of the assignment 
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to all the variables in tj, by = A(tt (for every % e t,). Given these values, 

one can check wether or not the predicate ipj is satisfied. Note that in the correct proof ipj 
must be satisfied. 

In general, the verifier expects p{jj, S) to be a function from S to F (and we can think of 
this function also as a function from F g+1 to F). Whenever the verifier reads a block p{jj, S), 
the verifier can check that p(rj,S) is indeed a polynomial of total degree at most n L5 , and 
that the values induced from p(tj,S) to the set Tj satisfy the predicate ipj. Since the verifier 
rejects automatically whenever a block that doesn't pass these tests is read, we can assume 
w.l.o.g. that all the blocks pass these tests. That is, every p(Tj,S) is a polynomial of total 
degree n L5 , and the values induced from it to the set Tj satisfy the predicate ipj. 

The verification procedure goes as follows. The verifier performs Step I of the quantum 
low degree test, as described in Subsection 4.2, and proceeds to Step II. At the beginning of 
Step II, the verifier needs to read gt (for the line £ obtained in Step I). This is done as follows: 
The verifier chooses a random j e [k]. If S(£,Tj) is of dimension q + 1, define S = S(£,Tj). 
Otherwise, define S to be a random q + 1 dimensional affine subspace that contains S(£,Tj). 
The verifier reads p{rj, S) (and performs the above mentioned tests on pijj, S)), and define gt 
to be the polynomial induced from p{jj, S) (i.e., the restriction of p{jj, S) to £). The verifier 
continues with Step II of the quantum low degree test, as described in Subsection 4.2. 

5.2.5 Complexity of the Verifier 

We only need the complexity of the verifier to be polynomial in n. Note, however, that if the 
verifier has random access to x, p, then all tasks in the verification procedure can be performed 
in time poly-logarithmic in n. While this is not important for the proof, it is essential for 
scaling up the proof to NEXP, and may be important for possible future applications. 

5.2.6 Analysis of the Test 

Denote by V(x, | the output of the verifier on inputs (x, | $),£>)• Note that V(x, \ <&),p) 
is a random variable. 

The completeness of the test is straightforward. If there exists an assignment a±, ...,a n to 
Yi, ...,Y n that satisfies all predicates ip±, ...,(pk then the correct proof (|$),p), as described in 
Subsection 5.2.3, satisfies 

Prob[V(x, | = accept] = 1. 

The soundness of the test is given by the following lemma. The lemma shows that if for 
some (|<E>),p), Prob[V(:r, |$), p) = accept] is large then there is an assignment to Y±, Y n that 
satisfies many of the predicates ip±, ...,ipk- 
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d ■ n L5 



Lemma 5.2 Assume that for some and some 7, 

Prob[V(:r, | $),£>) = accept] > 7 > 

where c' is a (large enough) universal constant ande > is a (small enough) universal constant 
(as in Lemma \.5). Then, there exists an assignment a 1 ,...,a n to Y 1 ,...,Y n that satisfies at 
least 7 4 /100 fraction of the predicates ifi±, 



5.2.7 Proof of Lemma 5.2 

Recall that w.l.o.g. we can assume that every p(rj, S) : S — > F is a polynomial of total degree 
at most n 1 ' 5 , and that the values induced from it to the set Tj satisfy the predicate ipj. For 
every line £ G L that is contained in S, denote by p(rj, S)\e : £ — > F the restriction of p(tj, S) 

toe. 

For every £ G L, and every j G [A;], define : £ — > F as follows: If S(£,Tj) is of 
dimension q + 1, define 5 = S^, r,). Otherwise, define S to be a random q + 1 dimensional 
affine subspace that contains Tj). Define <?^j to be the restriction of p(rj, S) to £, that is, 
= p( T j,S)\e- Note that is the same as the polynomial ge defined by the verification 
procedure (see Subsection 5.2.4) in case that j is the random index in [k] that was picked by 
the procedure. For every lei, define ge : i — > F as follows: Choose a random j e [/c] and fix 
— fi'fj- Note that ^ is the same as the polynomial ge defined by the verification procedure 
(see Subsection 5.2.4). 

Denote, G = {ge}eeL- For every j e [k], denote Gj = {gej}eeL- Recall the definition of 
Agr[/i, G] in Subsection 4.1. By Lemma 4.5 (under the assumption that d is large enough and 
e is small enough), there exists h : F d — > F of total degree n 15 , such that, 

Agr[/i, G] > 7 4 /50. 

By the definitions of G, G^, 

Exp^Agr^Gj^Agrf/i, G\. 
Hence, for at least 7 4 /100 fraction of the indices j E [k], 

Agr[/ i ,G,]> 7 4 /100. (2) 

Define the assignment ai,...,a n to Yi,...,Y n to be the assignment induced from h, that 
is, Vi, Oi = /i(7r _1 (i)). We will show that for every j G [k] that satisfies inequality 2, the 
assignment ai,...,a n satisfies the predicate ipj. Hence, the assignment ai,...,a n to Yi,...,Y n 
satisfies at least 7 4 /100 fraction of the predicates <pi, fk, and the lemma is proved. 

Claim 5.3 For every j G [k] that satisfies inequality 2, the assignment a±, ...,a n to Y]_,...,Y n 
satisfies the predicate ipj . 
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Proof: 

Fix j G [k] that satisfies inequality 2. Denote by L' C L the set of all lines £, such that S(£, Tj) 
is of dimension exactly q + 1. Recall that for every £ G 

=p(r j ,S , (^r j ))|/ 

Since the dimension of the smallest affine subspace of F d that contains Tj is q — 1 < d — 2, 
most lines in L are also in L' . More precisely, the ratio is larger than 1 — l-Fl -1 . Hence, 

by inequality 2, 

Exp €6i ,Agr[/i, g tJ ] > Exp teL Agr[h, g t j] - {F^ 1 

= Agv[h, Gj] - > 7 4 /100 - |F| _1 . (3) 

Denote by S the set of all q + 1 dimensional affine subspaces S C F d that contain Tj. For 
every S £ S, denote by L$ the set of all lines i G L that are contained in 5, and denote by 
L' s C L,s the set of all lines I G L, such that S'(£, r^) = 5. In other words, L' s = L$ H L'. Note 
that {L' 5 }s e<s is a partition of L'. Hence, by inequality 3, 

E xPses E *PeeL' s A &[h, 9tj] = Exp €eL ,Agr[fr, g tJ ] 

> 7 4 /100 - (4) 
Note that for every £ G L' s , we have g^- = p(tj, S(£, Tj))\ e = p(Tj, S)\e. Hence, 

E Wses E WieL' s ^ob zee [h(z) = p( Tj , S)\ e (z)\. (5) 

For every S G «S, the dimension of the smallest affine subspace of S that contains Tj is 
g — 1 = (q + 1) — 2. Hence, most lines in L 5 are also in L' 5 . More precisely, the ratio |L' 5 |/|L S | 
is larger than 1 — 2|F|~ 1 . Therefore, for every S G «S, 

Ex P^L s Prob 2 e£[^(^) =p(rj, 5)1/(2;)] > 

Exp /e ^Prob z6 ,[/i(*) = p(r,-, 5)|^)] - 2|^|~ 1 
Hence, by inequality 4 and equality 5, 

Ex Pses Ex PfeL 5 Prob ^[M^> =P( T j>S)U( z )} > 
Exp SeS Exp teLl Prob gee [h(z) = pfa, S)\ e (z)] - 2|F|~ 1 
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Exp SeS Exp teL , 8 Agr[h,g t j] - 2\F 



-i 



> 7 4 /l(D0-3|F 



-i 



Hence, by a uniformity argument, 



Exp Se5 Prob 2gS [/i(z) =p(Tj,S)(z)] 



Ex Pses Ex Pfe l s Pro W [h(z) 



p(Tj,S)\e(z)] 



> 7 4 /i00-3|F 



i 




-i 



Recall that h : F d -> F and pfo, S) : S ^ F are both polynomials of total degree at 
most n 15 . Thus, by Schwartz-Zippel's lemma, if they agree on a fraction larger than h 1 ' 5 /\F\ 
of the points z G S they must agree on every point z G S. Thus, under the assumption that 
the constant c (that determines the size of the field F) is large enough, h and pijj, S) agree 
on every point z G S. (Note that we have the freedom to fix c as large as we want). 

Since we assumed that the values induced from p(rj, S) to the set Tj satisfy the predicate tpj, 
we conclude that the values induced from h to the set Tj satisfy the predicate ipj. That is, the 
assignment a±, a n to Y±, Y n satisfies the predicate ipj. 

This ends the proof of Claim 5.3. □ 

Since inequality 2 holds for at least 7 4 /100 fraction of the indices j G [k], the assignment 
ai, a n to Y 1 , ...,Y n satisfies at least 7 4 /100 fraction of the predicates ip±, ipk- 

This ends the proof of Lemma 5.2. □ 



5.2.8 Completing the Proof of Theorem 5.1 

We have constructed an (0(logn),polylog(n))-verifier V, such that on an instance x = (y?i, ifk) 
of GAP(s ) q, e) the following properties are satisfied: 

1. If there exists an assignment to Yi,...,Y m that satisfies all predicates ipi,...,tpk, then 
there exist |$) and p, such that 



Prob[V(a;, = accept] = 1. 



(See Subsection 5.2.6). 
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2. If any assignment to Yi,...,Y m satisfies at most e fraction of the predicates ipi,...,ip k , 
then for any |$) and p, 

Prob[l / (x, |<3>),p) = accept] < o(l). 

(By Lemma 5.2). 

Hence, GAP(s,q,e) £ QPCP[log(n),polylog(n), o(l)], and since GAP(s,q, e) is iVP-complete 
we conclude that NP C QP CP [log (n),polylog(n), o(l)]. □ 
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